CVE-2026-101963: CWE-682 Incorrect Calculation in Juniper Networks Junos OS

This vulnerability (CVE-2026-101963) is an incorrect calculation flaw (CWE-682) in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos EVO. When Segment Routing over IPv6 (SRv6) EVPN multihoming is configured, a remote BGP EVPN neighbor can trigger a condition that causes the rpd process to crash. The crash leads to denial of service (availability impact) but does not affect confidentiality or integrity. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability. The affected versions include multiple ranges across Junos OS and Junos EVO releases, specifically versions >=25.2 and <25.2R2-S2, >=25.4 and <25.4R1-S3, >=26.2 and <26.2R1-S2, and their EVO and X100/X300 variants, plus version 23.4X100 exactly. No vendor advisory or patch links are provided in the input, so patch status is not confirmed.

The vulnerability allows a remote unauthenticated BGP EVPN neighbor to cause a crash of the routing protocol daemon (rpd) on affected Junos OS and Junos EVO devices when SRv6 EVPN multihoming is configured. This results in denial of service (availability impact). There is no impact to confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider disabling SRv6 EVPN multihoming if feasible or restricting BGP EVPN neighbor access to trusted entities to reduce exposure.